Informationen des Universitätsrechenzentrums:Nutzung der Computerpools Unicode - eine neue Art der Zeichenkodierung Sicheres Programmieren mit PHP (Teil 2) NIDS im Campusnetz MONARCH Achtung, Mail-Würmer! Kurzinformationen

No description available.

<p dir="ltr">With the increasing availability of inexpensive computing power in wireless radio network nodes, machine learning based models are being deployed in operations that traditionally relied on rule-based or statistical methods. Contemporary high bandwidth networks enable easy availability of significant amounts of training data in a comparatively short time, aiding in the development of better deep learning models. Specialized deep learning models developed for wireless networks have been shown to consistently outperform traditional methods in a variety of wireless network applications.</p><p><br></p><p dir="ltr">We aim to address some of the unique challenges inherent in the wireless radio communication domain. Firstly, as data is transmitted over the air, data privacy and adversarial attacks pose heightened risks. Secondly, due to the volume of data and the time-sensitive nature of the processing that is required, the speed of the machine learning model becomes a significant factor, often necessitating operation within a latency constraint. Thirdly, the impact of diverse and time-varying wireless environments means that any machine learning model also needs to be generalizable. The increasing computing power present in wireless nodes provides an opportunity to offload some of the deep learning to the edge, which also impacts data privacy.</p><p><br></p><p dir="ltr">Towards this goal, we work on deep learning methods that operate along different aspects of a wireless network—on network packets, error prediction, modulation classification, and channel estimation—and are able to operate within the latency constraint, while simultaneously providing better privacy and security. After proposing solutions that work in a traditional centralized learning environment, we explore edge learning paradigms where the learning happens in distributed nodes.</p>

L’objectif du travail de cette thèse est la contribution au développement de nouvelles techniques dans le domaine dessystèmes de détection sans marqueur pour une utilisation dans trois domaines vitaux de la santé en utilisant des capteursinnovants et peu coûteux. Pour la réalisation de nos objectifs nous avons eu recours principalement à de l’électroniqueembarquées et du traitement du signal en utilisant le capteur Kinect. Des résultats encourageants ont été obtenus et sontprésentés tout au long de cette thèse. Dans la première partie de ce travail, nous présentons un nouveau système desurveillance visuelle sans marqueur en temps réel pour détecter et suivre les personnes âgées et surveiller leurs activitésdans leur environnement intérieur en utilisant un réseau de capteurs Kinect. Le système identifie également l’événementde chute des personnes âgées sous surveillance. Dans la deuxième partie nous utilisons également le capteur Kinectmais cette fois ci pour la détection sans marqueur des mouvements de la tête d’un patient lors d’un examen utilisant LaTomographie par Emission de Positons (CT/PET) du cerveau. Ce travail est basé sur la compensation de la dégradationde l’image TEP due aux mouvements de la tête du patient. Pour nos essais un cobaye dit « fantôme » a été réalisé,les résultats sur le fantôme sont prometteur ce qui a donné lieu à un test sur un vrai patient volontaire. Les résultatsfinaux montrent l’efficacité de ce nouveau système. La troisième partie du travail présente la mise en oeuvre d’un nouveausystème intelligent pour contrôler un fauteuil roulant électrique par des mouvements spéciaux de la tête toujours sansmarqueur. Un algorithme adapté est conçu pour détecter en continu les degrés des mouvements du visage en utilisant lecapteur Kinect. Fautes de fauteuil roulant électrique, le système a été testé sur un véhicule radio commandé. / The objective of the work of this thesis is the contribution in developing novel technical methods in the field of marker-lesssensing systems for use in three vital health areas by using new inexpensive sensors. Several scientific areas are involvedin achieving our objective such as; electronics and signal processing by using the Kinect sensor. Encouraging results wereachieved as presented throughout this thesis. In the first part of this work we present a new real-time marker-less visualsurveillance system for detecting and tracking seniors and monitoring their activities in the indoor environment by usingnetwork of Kinect sensors. The system also identifies the fall event with the elderly. In the second part, we present anew approach for a marker-less movement detection system for influential head movements in the brain Positron EmissionTomography imaging (CT/PET) by employing the Kinect sensor. This work addresses the compensation of the PET imagedegradation due to subject’s head movements. A developed particular phantom and volunteer studies were carried out.The experimental results show the effectiveness of this new system. The third part of the work presents the design andimplementation of a new smart system for controlling an electric wheelchair by special mark-less head movements. Anadaptable algorithm is designed to continuously detect the rotation degrees of the face pose using the Kinect sensor inreal-time that are interpreted as controlling signals through a hardware interface for the electric wheelchair actuators.

Although it has been well established that abnormal group delay is a real physical phenomenon and is not in violation of Einstein causality, there has been little investigation into whether or not such abnormal behaviour can be used to reduce signal latency in practical communication systems in the presence of noise. In this thesis, we use time-varying probability of error to determine if abnormal group delay “channels” can offer reduced signal latency. Since the detection system plays a critical role in the analysis, three important detection systems are considered: the correlation, matched filter and envelope detection systems. Our analysis shows that for both spatially negligible microelectronic systems and spatially extended microwave systems, negative group delay “channels” offer reduced signal latency as compared to conventional “channels”. The results presented in the thesis can be used to design a new generation of electronic and microwave interconnects with reduced or eliminated signal latency.

Although it has been well established that abnormal group delay is a real physical phenomenon and is not in violation of Einstein causality, there has been little investigation into whether or not such abnormal behaviour can be used to reduce signal latency in practical communication systems in the presence of noise. In this thesis, we use time-varying probability of error to determine if abnormal group delay “channels” can offer reduced signal latency. Since the detection system plays a critical role in the analysis, three important detection systems are considered: the correlation, matched filter and envelope detection systems. Our analysis shows that for both spatially negligible microelectronic systems and spatially extended microwave systems, negative group delay “channels” offer reduced signal latency as compared to conventional “channels”. The results presented in the thesis can be used to design a new generation of electronic and microwave interconnects with reduced or eliminated signal latency.

This is a report on the possibility of using a Raspberry Pi as an intrusion detection system in a home environment to increase network security. The focus of this study was on how well two different generations of Raspberry Pi would be able to  handle network traffic while acting as an intrusion detection system. To examine this a testing environment was set up containing two workstation computers connected to a Raspberry Pi, each computer hosting a virtual machine. Tests measuring the network throughput as well as the CPU and memory usage were performed on each of the Raspberry Pi devices. Two models of Raspberry Pis were used; Raspberry Pi model B+ and Raspberry Pi 2 model B; each of them running the operating system Arch Linux ARM. The results of these tests were that both of the Raspberry Pis could be used as an intrusion detection system but has some limitations that could impede usage depending on the requirements of the user. Raspberry Pi 2 model B show benefits of its updated hardware by suffering lower throughput degradation than Raspberry Pi model B+, while using less of it's total CPU and memory capacity. / Den här rapporten behandlar möjligheten att använda en Raspberry Pi som ett intrångdetekteringssystem i en hemma miljö för att öka nätverkssäkerheten. Fokusen i den här studien ligger på hur väl de två senaste generationerna av Raspberry Pi skulle kunna hantera nätverkstrafik samtidigt som den undersöker nätverkstrafiken och söker efter hot. För att kontrollera hur väl en Raspberry Pi kan fungera som ett intrångdetekteringssystem har en laborationsmiljö upprättats bestående av två fysiska maskiner som vardera används för att virtualisera en virtuell maskin. Tester för att mäta datagenomströmning, processor och minnesbelastning utfördes på var och en av Raspberry Pi. Två modeller av Raspberry Pi användes; Raspberry Pi model b+ och Raspberry Pi 2 model b, både körde operativsystemet Arch Linux ARM. Resultatet av testerna visade att det går att använda båda enheterna för att upprätta ett intrångdetekteringssystem, men det finns vissa begränsningar i enheterna vilket kan begränsa implementationsmöjligheterna. Raspberry Pi 2 model B uppvisade bättre resultat i form av att den är lägre belastad och har en högre datagenomströmning till skillnad från Raspberry Pi model B+. Raspberry Pi 2 model B har nyare och snabbare hårdvara vilket är den troliga orsaken till att den presterar bättre.

This project is about security of computer networks using Intrusion Detection Systems. IDS contain rules for detection expressed with regular expressions, which are for detection represented by finite-state automata. The complexity of this detection with non-deterministic and deterministic finite-state automata is explained. This complexity can be reduced with help of regular expressions grouping. Grouping algorithm and approaches for speedup and improvement are introduced. One of the approches is Genetic algorithm, which can work real-time. Finally Random search algorithm for grouping of regular expressions is presented. Experiment results with these approches are shown and compared between each other.

Kryptobrytning är den processen där transaktioner kryptovaluta verifieras.Idag är olaglig kryptobrytning ett stort hot då det utgör en stor del avorganiserad brottslighet. Dessutom kan skadliga kryptobrytningsprogramförkorta en dators livslängd avsevärt. Program som används tillkryptobrytning drar även stora mängder processorkraft, vilket kan göra att endator börjar arbeta långsamt. För att detektera program på en dator går det attta till olika metoder.Syftet med arbetet är att undersöka om det går att identifiera kryptobrytningmed hjälp av verktyg som kan analysera paket som skickas över nätverk frånett kryptobrytningsprogram. Samtidigt observeras det vilka varianter avartefakter som kan urskiljas och vilka andra typer av metoder det finns atttillgå vid detektion av kryptobrytning.Resultatet visar att enbart specifika typer av kryptobrytningsattacker kanupptäckas med paketanalysatorer och systemverktyg eftersom en hackarekan, i de flesta fall, förbipassera verktygen. Däremot visar i de flesta fallresultatet att det finns nackdelar respektive fördelar med varje metod. Detmest effektiva sättet för att skydda privata tillgångar och publikaorganisationers resurser är att använda en flerskiktsstrategi genom attkombinera alla typer av metoder. Ett antal av de artefakter som hittades somkan vara till användning var IP adresser, MAC-adresser, geolokalisering ochmetadata. / Today, illegal crypto mining poses a significant threat because it plays a bigrole in organized crime. In addition, it can shorten the lifespan significantly.Programs dedicated to crypto mining also consume substantial amounts ofprocessing power, which can slow down a computer. Various methods can beemployed to detect such programs on a computer.The purpose of this work is to investigate whether it is possible to identifycrypto mining using tools that can analyze packets transmitted over thenetwork from a crypto mining program. Additionally, it is observed whichvariants of artifacts can be distinguished and what other types of methods areavailable for detecting crypto mining.The result shows that only specific types of crypto mining attacks can bedetected using packet analyzers and system tools, as a hacker can bypass thesetools in most cases. However, the result also indicates that there aredisadvantages and advantages to each method. The most effective way toprotect your assets and organizational resources is to use a multi-layeredstrategy by combining all types of methods. Some of the artifacts found thatmay be useful include IP addresses, MAC addresses, geolocation, andmetadata.

Cyber security is an emerging field in the IT-sector. As more devices are connected to the internet, the attack surface for hackers is steadily increasing. Network-based Intrusion Detection Systems (NIDS) can be used to detect malicious traffic in networks and Machine Learning is an up and coming approach for improving the detection rate. In this thesis the NIDS Zeek is used to extract features based on time and data size from network traffic. The features are then analyzed with Machine Learning in Scikit-Learn in order to detect malicious traffic. A 98.58% Bayesian detection rate was achieved for the CICIDS2017 which is about the same level as the results from previous works on CICIDS2017 (without Zeek). The best performing algorithms were K-Nearest Neighbors, Random Forest and Decision Tree. / IT-säkerhet är ett växande fält inom IT-sektorn. I takt med att allt fler saker ansluts till internet, ökar även angreppsytan och risken för IT-attacker. Ett Nätverksbaserat Intrångsdetekteringssystem (NIDS) kan användas för att upptäcka skadlig trafik i nätverk och maskininlärning har blivit ett allt vanligare sätt att förbättra denna förmåga. I det här examensarbetet används ett NIDS som heter Zeek för att extrahera parametrar baserade på tid och datastorlek från nätverkstrafik. Dessa parametrar analyseras sedan med maskininlärning i Scikit-Learn för att upptäcka skadlig trafik. För datasetet CICIDS2017 uppnåddes en Bayesian detection rate på 98.58% vilket är på ungefär samma nivå som resultat från tidigare arbeten med CICIDS2017 (utan Zeek). Algoritmerna som gav bäst resultat var K-Nearest Neighbors, Random Forest och Decision Tree.